Add sample policy for cat(1).
This is one of the smallest working examples of seccomp being used on a
"real world" executable.
Bug: None
Test: As root: minijail0 -S cat.policy -- /bin/cat <file>.
Test: As regular user:
Test: ./minijail0 -n -S examples/cat.policy -- /bin/cat /proc/self/status
Change-Id: I521be5d97828f98482282e7996803ffead265bcf
diff --git a/examples/cat.policy b/examples/cat.policy
new file mode 100644
index 0000000..dea3dd3
--- /dev/null
+++ b/examples/cat.policy
@@ -0,0 +1,16 @@
+# In this directory, test with:
+# make LIBDIR=.
+# ./minijail0 -n -S examples/cat.policy -- /bin/cat /proc/self/status
+# This policy only works on x86_64.
+
+read: 1
+write: 1
+rt_sigreturn: 1
+exit_group: 1
+
+open: 1
+close: 1
+fstat: 1
+# Enforce W^X.
+mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
+fadvise64: 1
